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Abstract 

We consider the model of population protocols introduced by Angluin et al. lAAD + 04l . in which 
anonymous finite-state agents stably compute a predicate of the multiset of their inputs via two-way 
interactions in the all-pairs family of communication networks. We prove that all predicates stably 
computable in this model (and certain generalizations of it) are semilinear, answering a central open 
question about the power of the model. Removing the assumption of two-way interaction, we also 
consider several variants of the model in which agents communicate by anonymous message-passing 
where the recipient of each message is chosen by an adversary and the sender is not identified to the 
recipient. These one-way models are distinguished by whether messages are delivered immediately or 
after a delay, whether a sender can record that it has sent a message, and whether a recipient can queue 
incoming messages, refusing to accept new messages until it has had a chance to send out messages of 
its own. We characterize the classes of predicates stably computable in each of these one-way models 
using natural subclasses of the semilinear predicates. 

1 Introduction 

In 2004, Angluin et al. lAAD + 4 1 proposed a new model of distributed computation by very limited agents 
called a population protocol. In this model, finite-state agents interact in pairs chosen by an adversary, with 
both agents updating their state according to a joint transition function. For each such transition function, 
the resulting population protocol is said to stably compute a predicate on the initial states of the agents if, 
after sufficiently many interactions in a fair execution, all agents converge to having the correct value of the 
predicate. Motivating scenarios include models of the propagation of trust in populations of agents IDFOll 
and interactions of passively mobile sensors [A AD + 04llAAD + 06ll . Similar models of pairwise interaction 
have been used to study the propagation of diseases [Bai75| and rumors [DK65| in human populations and 
to justify the Chemical Master Equation [Gil92 ], suggesting that the model of population protocols may be 
fundamental in several fields. 

Because the agents in a population protocol have only a constant number of states, it is impossible for 
them to adopt distinct identities, making them effectively anonymous. An agent encountering another agent 
cannot tell in general whether it has interacted with that agent before. Despite these limitations, populations 
of such agents can compute surprisingly powerful predicates on their initial states under a reasonable global 
fairness condition. When each agent may interact with every other agent, any predicate over the counts 
of initial states definable in Presburger arithmetic is computable I AA D + 04llAAD + 06 1 . When each agent 
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has only a bounded set of neighbors with which it can interact, linear-space computable predicates are 
computable lAAC + 05l . 

In this paper we give exact characterizations of the class of stably computable predicates in the all- 
pairs interaction graph for the original population protocol model and certain natural variants of it that 
we introduce to model the restrictions of one-way communication. Most of the results in this paper have 
appeared in extended abstract form in the two conference papers [AAE06b AAER05]. In Section^we also 
correct an erroneous claim in BAAER05I . 

1.1 Stably Computable Predicates Are Semilinear 

Angluin et al. IIAAD+04IIAAD+06) showed that various common predicates such as parity of the number 
of agents, whether agents in some initial state a outnumber agents in another initial state b, and so forth, 
could be stably computed by simple population protocols. They further showed that population protocols 
could in fact compute any semilinear predicate, which are precisely those predicates definable in first-order 
Presburger arithmetic [Pre29|. But it was not known whether there were other, stronger predicates that could 
also be computed by a population protocol, at least in the simplest case where every agent was allowed to 
interact with every other agent. We show that this is not the case: that the semilinear predicates are precisely 
the predicates that can be computed by a population protocol if there is no restriction on which pairs of 
agents can interact with each other. This gives an exact characterization of the predicates stably computable 
by population protocols, answering the major open question of IAAD + 04| |aAD + 06 I. 

These results also answer an open question in lAAC + 05ll : whether requiring population protocols to 
deal with stabilizing inputs (rather than assuming all inputs are available at the start of computation) reduces 
their computational power. We show that the answer is no; in both cases, the stably computable predicates 
are precisely the semilinear predicates. 

The semilinearity theorem is proved for a generalization of the model of population protocols, and 
applies to stable computation in other models that have the property that a partitioned subpopulation can still 
run on its own (in the sense that agents do not have any mechanism to detect if additional agents are present 
but not interacting). Other models with this property include vector addition systems [HP78 1, some forms of 
Petri nets, and 1-cell catalytic P-systems. The relationship between semilinear sets and catalytic P-systems, 
which can be represented as population protocols in which all state-changing interactions occur between 
an unmodified catalyst and at most one non-catalyst agent, has previously been considered by Ibarra, Dang 
and Egecioglu [IDE04], who show that the sets accepted by 1-cell catalytic P-systems are semilinear. Our 
results extend this fact to predicates stably computable in this model, even without the catalytic restriction. 

Semilinearity is strongly tied to the notion of stable computation, in which a correct and stable output 
configuration must always be reachable at any step of the computation. Mere reachability of a desired final 
configuration is not enough: the reachability sets of population protocols are not in general semilinear. An 
example of this phenomenon may be derived from the construction given by Hopcroft and Pansiot of a 
non-semilinear reachability set for a six-dimensional vector addition system [HP78|. 

1.2 One-way communication 

We also introduce variants of the population protocol model that use forms of one-way communication anal- 
ogous to traditional asynchronous message-passing models, and exactly characterize their computational 
power in the all-pairs communication graph in terms of natural subclasses of the semilinear predicates. In 
the one-way models, pairwise interactions are split into separate send and receive events that each affect 
at most a single agent. These models may better reflect communication in the context of sensor networks, 
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where radio communication may not be bidirectional, even between nearby sensors. Moreover, one-way 
message-passing primitives may be easier to implement in practice. 

For the one-way models, we consider the following attributes. The sender may be allowed to change 
its state as a result of sending a message (transmission models), or not (observation models). The send and 
receive events for a message may occur simultaneously (immediate delivery models) or may be subject to a 
variable delay (delayed delivery and queued delivery models). In the queued delivery model, a receiver may 
choose to postpone incoming messages until it has had a chance to send a message of its own; in the simpler 
delayed delivery models, the receiver does not have this option. Thus, we consider five one-way models: 
immediate and delayed observation, immediate and delayed transmission, and queued transmission. 

The immediate models are perhaps best understood in terms of interactions between agents, while the 
delayed and queued models are better thought of in terms of messages sent from one agent to another. In the 
transmission models, the sender is aware that it has sent a message, and may update its state accordingly. 
In the observation models, the sender is unaware of being observed by the receiver, and therefore does 
not update its state. For example, consider a passive radio frequency tag that does not update its state in 
response to being read; this is an example of immediate observation, in which the message (tag data) is 
immediately delivered (read), but the state of the sender is unchanged. A web page that updates a counter 
in response to a visit can be thought of as an example of immediate transmission: the message (web page 
contents) is immediately delivered (viewed), and the web page is aware of the transaction and updates its 
state accordingly. 

We give exact characterizations of the classes of predicates that can be stably computed in each of the 
one-way models we consider. We show that the model of queued transmission stably computes exactly the 
semilinear predicates and is equivalent in power to the standard population protocol model with two-way 
interactions. The other models are strictly weaker, and can be characterized in terms of natural subclasses of 
the semilinear predicates. Weakest of all is the delayed observation model, which allows only the detection 
of the presence or absence of each possible input symbol. Next is the immediate observation model, which 
allows counting of input symbols up to an arbitrary constant limit. The immediate and delayed transmission 
models are equivalent to each other in power, and add the ability to count input symbols modulo an arbitrary 
constant. These results give us a precise and detailed understanding of the capabilities of the one-way 
models. 

2 Related Work 

2.1 Population Protocols and Related Models 

Stable computation by population protocols was introduced in It was shown that all 

semilinear predicates are stably computable by population protocols in the all-pairs interaction graph. It was 
also shown that the all-pairs interaction graph has the least computational power, in the sense that it may be 
simulated in any other connected interaction graph. This work was inspired by models of the propagation of 
trust studied by Diamadi and Fischer [DF01 1. Related models of automata with a central finite control and 
storage consisting of an unordered multiset of tokens was studied in llAAD+03) . 

Angluin et al. I A AD + 04llAAD + 06 1 also introduced probabilistic population protocols, in which a uni- 
form random choice of pairs to interact replaces the fairness condition; this enables quantification of the 
probability of error and the number of interactions to convergence as a function of n, the number of 
agents in the population. It was shown that each semilinear predicate can be computed in an expected 
0(n 2 log n) interactions, and that a register machine with a constant number of registers with O(logn) 
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bits per register could be simulated with inverse polynomial error probability and polynomial slowdown. 
Recent work [AAE06a| has given faster protocols for these problems under the assumption that a unique 
leader is present in the population: each semilinear predicate can be computed in an expected 0(n log 4 n) 
interactions, and an improved register machine simulation can be done with inverse polynomial error in 
0(n polylog(n)) interactions per step. 

The question of what properties of the interaction graph are stably computable by population protocols 
was studied in lAAC + 05 1. It was shown that for any d, there is a population protocol that organizes any 
connected interaction graph of maximum degree at most d into a linear memory of B(n) bits, which is 
asymptotically optimal. In the same paper, the population protocol model was extended to stabilizing inputs, 
in which each agent has an input that may change finitely many times over the course of the computation 
before stabilizing to a final value; this permits composition of protocols, in which the stabilizing outputs 
of one protocol become the stabilizing inputs of another protocol. It was shown that all the semilinear 
predicates can be computed with stabilizing inputs in the all-pairs interaction graph. Thus, the present paper 
shows that the precisely the same predicates are stably computable with or without stabilizing inputs in the 
all-pairs interaction graph. 

Self-stabilizing population protocols were studied in IIAAFJ05I . which gives self-stabilizing protocols 
for token circulation in a directed ring, directing an undirected ring, local addressing in a degree bounded 
interaction graph, and leader election in a ring with a constant bound k on the smallest nondivisor of the 
ring size. The question of resilience to crash faults and transient faults was considered by Delporte-Gallet et 
al. JDGFGR06|, who give a general method to transform a population protocol into one that can withstand 
up to c crash faults and t transient faults. 

2.2 Comparison with Asynchronous Message-passing 

In an asynchronous message-passing model, agents communicate by sending messages. An agent may 
spontaneously send a message at any time, which is delivered to a recipient at some later time. The recipient 
may respond to the message by updating its state and possibly sending one or more messages. In the standard 
asynchronous model, senders can choose the recipients of their messages, and recipients are aware of the 
identities of the senders of messages they receive; however, in the population protocol models we consider, 
these assumptions are dropped. 

Agents in the population protocol models are assumed to be finite-state. Moreover, algorithms in this 
model are uniform: the description of the protocol cannot depend on the number of agents in the system. To- 
gether with a transition rule that depends only on the states of the two interacting agents, these assumptions 
naturally yield a model in which agents are effectively anonymous. In this respect, the population protocol 
models are weaker than a typical message-passing model, where processes have identities. In addition, not 
only does a receiver not learn the identity of the sender, but a sender cannot direct its message to a particular 
receiver. This is unusual even in anonymous message-passing models, which typically assume that a process 
can use some sort of local addressing to direct messages to specific neighbors. 

The question of what computations can be performed in anonymous systems, where processes start 
with the same state and the same programming, has a long history in theoretical distributed computing. 
Many early impossibility results such as [Ang80| assume both anonymity and symmetry in the communi- 
cation model, which limits what can be done without some mechanism for symmetry-breaking. See [FR03 1 
for a survey of many such impossibility results. More recent work targeted specifically at anonymity has 
studied what problems are solvable in message-passing systems under various assumptions about the ini- 
tial knowledge of the processes I B V99llB V01 llSak 99 1 . or in anonymous shared-memory systems where the 
properties of the supplied shared objects can often (but not always, depending on the details of the model) 
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be used to break symmetry and assign identities IASS()2IIAC?M02llBPSV()6llES94llC}R()51IJT90IIK()PS()0l 
ILP90llPPTV98llTe n90 1 . This work has typically assumed few limits on the power of the processes in the 
system other than the symmetry imposed by the model. 

Asynchronous message-passing systems may be vulnerable to a variety of failures, including failures 
at processes such as crashes or Byzantine faults, and failures in the message delivery system such as 
dropped or duplicated messages. In this paper we assume fault-free executions; however, Delporte-Gallet et 
al. |DGFGR06 1 characterize the power of population protocols in the presence of crash faults and transient 
faults. 

Because message delivery is asynchronous, making any sort of progress requires adopting some kind of 
fairness condition to exclude executions in which indefinitely-postponed delivery becomes equivalent to no 
delivery. A minimal fairness condition might be that if some process sends a particular message m infinitely 
often, then each other process receives the same message m infinitely often. In Sectional we show that even 
with unbounded states and message lengths, this minimal fairness condition provides only enough power to 
detect the presence or absence of each possible input because of the very strong anonymity properties of the 
model. Instead we adopt a stronger global fairness condition derived from that used in lAAD + 04lAAD + 06 1, 
which is defined and further discussed in Section|4] 

Considering the communication capabilities of the population protocol models, the two-way population 
protocol model is stronger than a typical message-passing model: communication between two interacting 
agents is instantaneous and bidirectional. Instantaneous communication is also a feature of the immediate 
transmission and immediate observation models. The observation models are weaker than message-passing 
in that the sender is not aware of sending a message. In the immediate and delayed transmission models, 
an agent must be prepared to receive and react to a message at all times. In the queued transmission model, 
which most closely approximates asynchronous message-passing, an agent may postpone receiving a mes- 
sage until it has sent messages of its own, and we show that this capability is essential to achieve the full 
power of the model. 

3 Preliminaries 

Let N denote the set of natural numbers, 0, 1, 2, . . .. The set of all functions from a set X to a set Y is 
denoted Y x . Let E be a finite nonempty set. For all f,g£ R , we define the usual vector space operations 

(f + g)(e):=f(e)+g(e) Ve G E 
(f-g)(e):=f(e)-g(e) Ve G E 
(c/)(e) :=c/(e) Vc G R, e G E 

f.g:=Y J f(e)g(e). 

Abusing notation, we define a vector and standard basis vectors 

0(e) := Ve G E 

e(e') := [e = e] Ve, e G E, 

where [condition] is 1 if condition is true and otherwise. We define a natural partial order on R E 
componentwise: 

/ < g O (Ve G E)f(e) < g(e). 
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Next we define the set of populations on E: 

Pop(£) :=N E \{0}. 

These may be interpreted as the nonempty multisets on E: for any / G Pop(E) and e £ E, /(e) represents 
the multiplicity of the element e in the multiset represented by /. Then, the partial order < corresponds to 
the subset order on multisets. 

4 A Unified Framework 

In each of the models we consider, a protocol can be considered as determining five components: a count- 
able set C of configurations; a set of input symbols E; a binary relation — > on C that captures when the 
first configuration can reach the second in one step; a function I : Pop(S) — > C that takes inputs to initial 
configurations; and a partial function O : C — > {0, 1} that gives the output of each configuration on which 
it is defined. We take — ► to be the reflexive-transitive closure of — ►. We say d is reachable from c if c ^> d . 
In this unified framework, we make the following definitions. 

A configuration c is output stable with output b if 0(c) = b and for every d such that c — > d, 0(d) = b. 
We define Si to be the set of configurations that are output stable with output b, for b G {0, 1}, and define 

5 = Sq U <Si to be the set of all output stable configurations. Thus a configuration is output stable if and 
only if its output is defined, and every configuration reachable from it has the same defined output. 

An execution is a (finite or infinite) sequence of configurations cq, ci, . . . such that for all j, we have 
Cj — ► Cj + i- An execution cq, ci, . . . is fair if for all d G C, either there exist infinitely many j such that 
Cj = d or there exists j such that cj d. This is equivalent to the global fairness condition defined 
in lAAD + 04llAAD + 06l . and implies that a global configuration that is infinitely often reachable in a fair 
execution must occur infinitely often in that execution. This fairness condition may be viewed as an attempt 
to capture useful probability 1 properties in a probability-free model. In Section[^]we show that a weaker, 
but plausible, fairness condition severely limits the power of the model. Since C is countable, any finite 
execution is a prefix of a fair execution, which can be constructed as follows. Fix an enumeration of C 
where each configuration appears infinitely often. Then, starting with the finite execution, repeatedly extend 
it with a sequence of configurations that reaches the next configuration in the enumeration that is reachable 
from the last configuration of the execution constructed in the previous step. 

A fair execution cq , c\ , . . . converges with output b if there exists an m such that for all j > m, the 
function O is defined on Cj and O(cj) = b. In particular, a fair execution converges with output b if and 
only if it reaches an output stable configuration with output b. A protocol is well-specified if, for all initial 
configurations Co G 7(Pop(S)), there exists a b such that all fair executions cq, c\, . . . converge with output 
b. In a well-specified protocol, every fair execution starting from an input configuration converges with an 
output that is determined by that input configuration. 

A well-specified protocol induces a predicate rp : Pop(S) — > {0, 1}. We say that this protocol stably 
computes ift. The results in this paper characterize the predicates ip stably computable in various models of 
finite local state distributed computing. 

5 Definitions of Models 

In this section we define the standard model of two-way population protocols in the all-pairs interaction 
graph and the one-way variants we consider, as well as the Abstract Model, which subsumes all of these. 
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For each model, we specify the configurations, input alphabet, one-step reachability relation, input map and 
output map required by the unified framework above. 

5.1 Two-way 

A two-way protocol is specified by five components: Q, a finite set of states; E, a finite set of input symbols; 
5 : Q x Q — > Q x Q, a joint transition function; i : E — > Q, the initial state mapping; and o : Q — ► {0, 1}, 
the individual output function. 
We define 

C := Pop(Q) 

ctGS 

O(c) := 6 if for all q G Q, c{q) > 1 =► o(q) = b 

We define c — »■ c' if gi + q 2 < c, c' = c - #i - q 2 + g x + <7 2 and g 2 ) = Q^)- 

A configuration in this model is a multiset that gives the states of all the agents. Because agents do 
not have identifiers and we are considering the all-pairs communication graph, agents in the same state are 
interchangeable; thus, the multiset of their states completely specifies the global state of the population. An 
initial configuration sets the state of each agent according to the input symbol assigned to it. A step is an 
interaction between two agents and simultaneously updates both of their states according to the value of the 
joint transition function of their current states. If the transition used is 5(q±, q 2 ), we refer to the agent in state 
qi as the initiator and the other agent as the responder. 

Each agent has an individual output of or 1 determined by its current state via the function o. The 
configuration output function is (respectively, 1) if all the individual outputs are (respectively, 1). If the 
individual outputs are mixed 0's and l's, then the configuration output function is undefined. 

5.2 Transmission with Queuing 

A queued transmission protocol is specified by seven components: Q, a finite set of states; M, a finite set 
of messages that is disjoint from Q; E, a finite set of input symbols; S s : Q — > M x Q, a transition function 
for sent messages; S r : Q x M — > Q, a partial transition function for received messages; i : E — > Q, the 
initial state function; and o : Q — ► {0, 1}, the individual output function. We define 

C :={ce N QUM : c(q) > for some q G Q} 

O(c) := b if for all q G Q, c{q) > 1 o(q) = b. 

We have c — ► d if for some state q G c and some message m, d = c — q + q' + m where (m, q') = S s (q); 
or if there exists a message m G c and a state q G c such that d = c — q — m + S r (q, m). In the latter case, 
S r (q, m) must be defined. 

A configuration in this model is the multiset of all agents' states and all messages in transit. (They cannot 
be confused, because Q and M are disjoint.) An input configuration has no messages in transit and sets the 
state of each agent according to the input symbol assigned to it. A step is either a send event, in which an 
agent in state q adds a message m to the multiset of messages in transit and goes to state q' (according to 
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$s(q) = (m, <?')') or a receive event, in which a message m is removed from the multiset of messages in 
transit and is delivered to an agent in state q, which updates its state to q' (according to S r (q, m) = q'.) If 
S r (q, m) is not defined, then message m cannot be delivered to an agent in state q; this permits agents to 
refuse to receive messages temporarily. (We note that because an agent in an observation model does not 
change state upon being observed, there would be no way for it to leave a non-receive enabled state; thus 
we do not consider a queued observation model.) 

5.3 Immediate Transmission and Observation 

Immediate transmission is a special case of the two-way model in which the state of the initiator is updated 
independent of the state of the responder. That is, there exist functions 5\ : Q — > Q and 82 : Q x Q — > Q 
such that for all q\,q2 € Q, we have S(qi, ^2) = (Si(qi), ^((Zi, 0.2))- Thus, the initiator (or sender) is aware 
of the fact that an interaction has taken place (or of sending a message), and may update its state accordingly, 
but it is not aware of the state of the responder (or receiver.) 

Immediate observation is a special case of immediate transmission in which 5\ is the identity function. 
This is the situation in which the initiator (or sender) is not aware of being "observed" by the responder (or 
recipient) and therefore does not have an opportunity to update its state. 

5.4 Delayed Transmission and Observation 

Delayed transmission is a special case of queued transmission, with the requirement that 5 r be a total 
function. In this case, the recipient does not have the option of temporarily refusing to receive messages, 
which means that it is in danger of being "overwhelmed" by incoming messages. Our characterization 
results show that this indeed limits the power of protocols in this model. 

Delayed observation is a special case of delayed transmission in which for all q G Q, we have 5 s (q) = 
(q, m) for some m € M. In this model, the weakest of those we consider, an agent can neither refuse 
incoming messages nor update its state when it has sent a message. 

5.5 The Abstract Model 

In order to present our semilinearity characterization in full generality, we introduce another model. All of 
the preceding single step rules can be described in terms of replacing one collection of elements (states or 
messages) with another without regard to the other elements in the configuration. In this model it is also 
convenient to identify input symbols with the states they map to, dispensing with the need for an initial state 
map 1. 

E is a set of elements, which may be either states or messages; S C E is a set of input symbols; — > is a 
relation on Pop(.E') such that if c — > d, then for all d S Pop(-E'), we have c + d — ► d + d; o : E — > {0, 1} 
is the individual output map. Then, 



To see that this generalizes the two-way model, we take E to be the disjoint union of the input symbols 
and states of the two-way model, and treat the input symbol a as equivalent to the state t(a), extending the 
individual output map o to S by o(a) = o(i(a)). To see that the Abstract Model also generalizes the queued 



I(x) 
0(c) 



C 



Pop(E) 
x, and 

b if for all e G E, c(e) > 1 o(e) = b. 
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transmission model, we define E to be the disjoint union of the input symbols, states, and two copies of the 
messages of the queued transmission model. Having two copies of each message m allows us to designate 
one copy as having output and the other as having output 1. Again we treat input symbol a as equivalent 
to the state i(a), and extend the individual output map o to S by o(a) = o(i(cr)). Also, we extend o to the 
two copies of each message by defining it to be the designated output of that copy. To ensure that outputs 
propagate from agent states to messages, we add rules that take a state of an agent and a copy of a message, 
and change (if necessary) the designated output of the message to be the same as the output of the state. 
Each send rule is modified to send a message with the same output value as the sender, and the receive 
rules ignore the output values of the messages. These changes guarantee that when the outputs of the agents 
stabilize, the designated outputs of the messages stabilize to the same thing. Thus, every predicate stably 
computable in either the two-way or the queued transmission model is stably computable in the Abstract 
Model. 

5.6 Mirrors and Messages to Self 

Separating message transmission and receipt creates the possibility that an agent may receive its own mes- 
sage. Because senders are not identified, such an agent will in general not be able to recognize the message 
as its own. This can be thought of as including mirrors, or self-loops in the interaction graph controlling 
which agents can communicate, which we otherwise take to consist of all ordered pairs of agents. In general, 
we assume that this does not occur in the two-way and immediate delivery models, which are perhaps best 
thought of as interaction models, but may occur in the delayed and queued delivery models, on the principle 
that once an anonymous message is sent it may be delivered to anyone. This has at most a minor effect on 
the computational power of the models we consider, which we note below as appropriate. 

6 Predicate Classes 

We now define the classes of predicates used in our characterizations. Although stably computable pred- 
icates are defined only on Pop(S), our proofs are facilitated by defining predicate classes on Z s . The 
support of a predicate is the set of all inputs that make it true. 

6.1 Semilinear Predicates 

The most important class of predicates we consider is the class of semilinear predicates, which we write 
SLIN. This class can be defined in several equivalent ways. 

A linear set is a set of the form {b + kipi + k 2 p2 + • • • + k n p n \ ki, k 2 , . . . , k n > 0}, where 
b,Pi,P2, ■ ■ • ,p n are vectors. The vector b is the base of the linear set, and the vectors pi are the period 
vectors. A semilinear set is a finite union of linear sets. A (semi)linear predicate is a predicate whose 
support is (semi)linear predicate. 

Semilinear sets are also precisely the sets definable by first-order formulas in Presburger arithmetic [Pre29 1 
which are formulas in arithmetic that use only <, +, 0, 1, and the standard logical quantifiers and connec- 
tives. Here the set consists of all satisfying assignments of the free variables; for example, the semilinear 
set S = {(1,0) + fei(l, 0) + k 2 {0, 2)} U {(0, 2) + k 3 (2, 0)}, depicted in Figured consists precisely of the 
satisfying assignments (x, y) of the formula 

(3z : (z > 0) A (x = z + z + 1) A (y > z)) V (3z : (z > 0) A (x = z + z) A (y = 1 + 1)) , (1) 
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Figure 1: A semilinear set S, equal to the union of the linear set of all points {(1, 0) + fci(l, 0) + k 2 (0, 2)} 
(dark circles) and the linear set {(0, 2) + £3(2, 0)} (shaded circles). 

where x = y abbreviates ->((z < y) V (y < x)) and x > y abbreviates ->(y < x). It follows immediately 
from the correspondence between semilinear sets and Presburger formulas that the semilinear sets are closed 
under complement, finite intersection and finite union. Thus a predicate is semilinear if and only if its 
complement is semilinear. 

A curious and useful property of Presburger formulas is that all quantifiers (and their bound variables) 
can be eliminated by the addition of binary relations = m that test for equality modulo m for any nonnegative 
integer m [Pre29 1. For example, the formula Q defining S can be rewritten without quantifiers as 

((x > 0) A (x =2 1) A (x < y + y + 1)) V {(x > 0) A (s = 2 0) A (y = 1 + 1)). 

This yields another characterization: a semilinear predicate is a boolean combination of threshold pred- 
icates, whose support takes the form {x \ x ■ v > r} for some v G Z s and r£Z, and modulo predicates, 
whose support takes the form {x \ x ■ v = r (mod m)} for some u 6 Z 2 and r, m G Z with m > 0. Viewed 
geometrically, sets of the first type consist of points on one side of a hyperplane, and sets of the second type 
are lattices. As an example of a predicate of the first type, consider comparison, which is true if the number 
of a's in the input exceeds the number of fe's in the input. As an example of a predicate of the second type, 
consider parity, which is true if the number of a's in the input is odd. 

In yet another characterization, Parikh's Theorem [Par66| shows that a subset S of N d is semilinear if 
and only if there is a context-free language L over an alphabet of d symbols such that S consists of the 
vectors of multiplicities of alphabet symbols of strings in L. Moreover, the same statement holds with 
regular languages in place of context-free languages. Using this characterization, it is not difficult to see that 
the following predicates on the number of a's and b's in the input are not semilinear: the number of a's is a 
prime, the number of a's is a square, the number of a's is a power of 2, and the number of a's is bounded 
above by y/2 times the number of b's. 

6.2 The Classes MOD and coreMOD 

We write MOD for the class of boolean combinations of modulo predicates only. 

Let E' C S be any nonempty subset of the input alphabet. Then x £ Z s is a fc-rich profile with respect 

to £' if x(a') > k for all a' G £' and x(a) = for all a G £ \ Let ip and tp' be predicates on Z E . If 
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ip(x) = ip'(x) for every x that is a /c-rich profile with respect to Tl , then we say that tp and ip' are £>similar 
with respect to £'. 

The class coreMOD is the class of predicates tp such that for every nonempty £' C S, there exists a 
t// G MOD and k > such that ^ is /c-similar to ip' with respect to S'. Clearly MOD C coreMOD, so 
the parity predicate is in coreMOD. The comparison predicate is not in coreMOD because it is not k- 
similar to any modulo predicate with respect to {a, b} for any k > 0. However, if we consider the predicate 
over the alphabet {a, b, c} that is true when there is exactly one c and the number of a's exceeds the number 
of b's, then this predicate is in coreMOD. To see this, note that the predicate is false when the number of 
c's is or at least 2, so k = 2 suffices as a witness for any nonempty subalphabet. 

6.3 Simple Threshold Predicates 

We define a simple threshold predicate to be a threshold predicate with support {x | x • v > r} in which 
v = a for some input symbol a. An example of a simple threshold predicate is one that is true when 
the number of a's is at least 5. Then we define COUNTS to be the class of boolean combinations of 
simple threshold predicates in which the threshold value r < k. A predicate in COUNT^ is completely 
determined by the counts of the input symbols truncated at k. For example, when k = 1, such a predicate 
depends only on the presence or absence of each input symbol. Finally, COUNT* is the union of the 
classes COUNTfe for k = 1, 2, 3, . . .. The comparison predicate is an example of a threshold predicate 
that is not in COUNT*. 

7 Summary of Characterizations 

The computational power of the population protocol models we consider is summarized in Figure |2] For 
each model we give the class of predicates on Pop(S) that can be stably computed by protocols in the 
model. Protocols in the Abstract Model, which subsumes the two-way and queued transmission models, 
stably compute exactly the semilinear predicates. The immediate and delayed transmission models are 
equal in power, and stably compute exactly those semilinear predicates that are in coreMOD; they cannot 
stably compute the comparison predicate. Immediate observation protocols stably compute exactly those 
predicates determined by the counts of the input symbols truncated at k for some k; they cannot stably 
compute the comparison predicate or the parity predicate. Delayed observation protocols stably compute 
exactly those predicates determined by the presence or absence of each input symbol; they cannot stably 
compute the comparison predicate, the parity predicate or simple threshold predicates for thresholds greater 
than 1. 

The results in [AAER05| incorrectly claimed that any two-way stably computable predicates /c-similar 
with respect to £ to a predicate in MOD is stably computable in the immediate and delayed transmission 
models, omitting the quantification over all nonempty subalphabets of the input alphabet. To see why the 
more complex condition is required, consider the predicate over the alphabet {a, b, c} that is true if there is 
at most one c in the input and the number of a's exceeds the number of 6's. This predicate is 2-similar to the 
constant false predicate with respect to {a, b, c] but it is not in the class coreMOD, because for no k > 
is it A;-similar to a predicate in MOD with respect to the subalphabet {a, b}. This predicate is not stably 
computable in the immediate and delayed transmission models. 
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Figure 2: The Power of Population Protocols 



8 Protocols 

We first give protocols for each model in Figure |2] to establish that each model is at least as powerful as 
claimed. 

8.1 The Two-Way Model 

From IAAD+04IIAAD+06H we have the following. 

Theorem 1. Every semilinear predicate on Pop(S) is stably computable by a two-way population protocol. 

To help us describe protocols in the one-way models, we here give specific two-way protocols for simple 
threshold, modulo and general threshold predicates. 



Simple threshold predicates. The following protocol computes the simple threshold predicate ip(x) 
[x • a > k], which is true when there are at least k occurrences of the input symbol a in the input x. 
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o(q) ■= [q = k] 

Initially, agents with input a are in state 1 and all other agents are in state 0. As this protocol runs, the states 
of the agents make a "tower". All but one of the agents in state i advance to state i + 1 in each case. This 
tower will extend to k if and only if there are initially at least k agents in nonzero states. We note that this is 
an immediate observation protocol because the state of the initiator remains unchanged by an interaction. 



Active and passive agents. In the protocols for the modulo predicate ip(x) = [x ■ v = r (mod m)] and 
the threshold predicate tp(x) = [x ■ v > r] agents fall into one of two categories: active or passive. Every 
agent is initially active, and there is at least one active agent at all times. Each active agent also has a data 
value, initially a • v, where a is the input symbol for this agent. When a passive responder meets an active 
initiator, it copies the output of the active initiator. When two passive agents meet, nothing happens. When 
two active agents meet, they attempt to combine their data values, and one of them may become passive. 
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Modulo predicates. For a modulo predicate, ip( x ) = [x ■ v = r (mod in)], the data values of active 
agents combine by sum modulo m. The initiator becomes passive while the responder remains active and 
keeps the combined data value. Eventually, exactly one agent is active and has the correct sum modulo m, 
and distributes the correct output to all of the other agents. We note that this is an immediate transmission 
protocol because the state of the initiator is updated uniformly, independent of the state of the responder. 

Threshold predicates. The situation for a threshold predicate, ^(a;) = [x ■ v > r], is more complicated. 
In the end there may be multiple active agents, but they will all agree on the output. We assume without loss 
of generality that r > 0. The active states are a range of values that include all possible initial data values 
and 2r — 1. The output is 1 if and only if the data value is at least r. Suppose u and v are the data values 
when two active agents meet. If u + v is representable by an active state, one agent remains active with 
this data value; the other becomes passive. Otherwise, both agents remain active and they average their data 
values, that is, one becomes f 1 ^] and the other becomes [^^J- These transitions maintain the invariant 
that the sum of all the active agents' data values is x ■ v . Note that this protocol involves updates of both 
states depending on both states; it is not an immediate transmission protocol. 

To show correctness, we distinguish three cases based on the sum of all the initial data values. In the 
first case, the sum is negative. Eventually, no active agent will have a positive data value. In the second case, 
the sum is between and r — 1. There will eventually be exactly one active agent with this data value. In 
the third case, the sum is at least r. The number of active agents with data value less than r never increases. 
The only way it can increase is after an interaction involving an active agent with value at least r where both 
agents remain active. This will happen, however, only in the case when the two agents average their values, 
which never happens with an agent with value at least r unless the result is both agents having value at least 
r. After there are no more agents with negative values, any interaction with an agent whose value is less 
than r will decrease the number of such agents. 

8.2 Queued Transmission 

When combined with Theorem^ the following theorem implies that every semilinear predicate on Pop(S) 
is stably computable in the queued transmission model. 

Theorem 2. Every predicate on Pop(S) stably computable in the two-way model is stably computable in 
the queued transmission model. 

Proof. Given any protocol in the two-way model, we describe a simulation of it by a protocol in the queued 
transmission model. Each agent can store up to two states from the two-way protocol. Initially, each agent 
has one state, which is determined from the input symbol for that agent by the initial state map of the 
protocol being simulated. Agents transfer states by sending a message. An agent called upon to send will 
send a message containing the state it has been holding longest. (If it is not currently holding any states, 
it sends a null message.) Any agent with free space is eligible to receive a message. Whenever an agent 
receives its second state, it uses the transition function from the two-way protocol to have the two interact, 
with the state it already has acting as the initiator. 

The simulated configuration cannot make any steps that were impossible under the two-way model. 
Conversely, any sequence of interactions made under the two-way model can be achieved by first having 
every agent launch all states it holds, and then by repeating the following actions: deliver two states to a 
particular agent, and then have the agent release both in messages. Therefore, the simulation is faithful. □ 
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8.3 Immediate and Delayed Transmission 

Theorem 3. Every predicate on Pop(S) in the class SLIN n coreMOD is stably computable in the 
immediate transmission model and also in the delayed transmission model. 

Proof. We first note that both models can stably compute simple threshold predicates and predicates in 
MOD. This is clear for immediate transmission because the two-way protocols given in Section l8l71 for 
simple threshold and modulo predicates are immediate transmission protocols. For the delayed transmission 
model, we specify that a sender sends its state and becomes passive, preserving its previous output. Passive 
messages are ignored by all receivers. An active receiver combines its data with the data from an active 
message, remaining active. (The data values u and v are combined as (u + v) mod m for a mod predicate or 
min(/c, u + v) for a simple threshold predicate.) A passive receiver sets its state equal to an active message, 
becoming active again. In a fair execution eventually every configuration will contain exactly one active 
agent or active message in transit, and when all agents have received the message, they can compute the 
correct output value. 

Suppose ip G SLIN n coreMOD. For each nonempty subset £' of the input alphabet S, we describe 
a protocol that computes ip assuming that £' is exactly the set of symbols present in the input x. We can 
"and" this protocol with one that verifies this assumption (it is a boolean combination of simple threshold 
predicates, and therefore stably computable in this model), and "or" together the resulting protocols for each 
choice of and the result will stably compute ip. 

Because ip G coreMOD, there is a predicate ip' G MOD and an integer k > such that ip is fc-similar 
to ip' with respect to Then ip' is stably computable by an immediate (or delayed) transmission protocol, 
as is the predicate that is true if x is fc-rich with respect to so the conjunction of these predicates correctly 
computes ip when there are at least k occurrences of each input symbol from £' and no occurrences of any 
other symbol. 

In the remaining cases some a G £' occurs between 1 and k — 1 times. Because ip G SLIN, it is 
stably computable by a two-way protocol. For each input symbol a G £' we describe below how to adapt 
the simulation of the two-way protocol in the proof of Theorem |2] to show that the predicate that is the 
conjunction of ip and the predicate that is true when there are between 1 and k — 1 occurrences of a in the 
input is stably computable in the immediate (or delayed) transmission models. Then we "or" these protocols 
together for all choices of a G 

The simulation of a two-way protocol by a queued transmission protocol requires queuing in order to 
prevent agents' storage from being overwhelmed by messages. However, suppose it may be assumed that at 
least one and at most k — 1 copies of a can appear in the input. In this simulation, each agent can store up to 
k states of the original protocol. We give the (at most k — 1) agents receiving input a "tokens" and require 
that every agent "pay" a token to the recipient every time it transfers a state. The result is that no agent can 
collect more than k states: one for the state it started with and k — 1 transfers. At that point, the agent has 
all of the tokens and cannot gain any more states. Thus, an agent never runs out of space for the messages it 
receives. 

To see that any step of the original protocol can be simulated in this protocol, consider a simulated 
configuration with two agents in states q\ and q^. First, the agent holding q\ sends q\ in a message. (If the 
agent does not have enough tokens to do so, deliver a message to it so that it gets the necessary token.) When 
q\ is a message in transit, some agent holds no states. Deliver q\ to such an empty agent. Then, the agent 
holding c/2 sends q2 in a message. (Again, deliver a token to this agent if required to make this happen.) 
Deliver q2 to the agent that holds q\ to cause an interaction between q% and qi. D 

Note in particular that immediate and delayed transmission protocols can stably compute the predicate 
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over the alphabet {a, b, c} that is true if there is exactly one c and the number of a's exceeds the number of 
6's. Intuitively, the single c in accepted inputs can be used to implement a kind of flow control on agents' 
incoming messages. The characterization in Section [T4.1l shows that the standard comparison predicate over 
{a, b}, which is true if the number of a's exceeds the number of fe's, is not stably computable by immediate 
or delayed transmission protocols, essentially because no such control of incoming messages is possible in 
this case. 

8.4 Immediate Observation 

Theorem 4. Every predicate on Pop(S) in COUNT* is stably computable in the immediate observation 
model. 

Proof. Every predicate in COUNT* can be expressed as a boolean combination of simple threshold predi- 
cates that depend only on the count of one input symbol. The two-way protocol in Section l8lTl for the simple 
threshold predicate [x ■ a > k] is in fact an immediate observation protocol because only the responder's 
state is updated in each case. □ 

The protocol from Section l8l71 uses k + 1 states, which can be reduced to k (by removing state 0) if the 
input alphabet is unary. It can be shown that k — 1 states are not sufficient to stably compute this predicate 
in the immediate observation model in the case of a unary alphabet; the proof is rather involved and will 
appear elsewhere. 

8.5 Delayed Observation 

Theorem 5. Every predicate on Pop(S) in COUNTi is stably computable in the delayed observation 
model. 

Proof. The two-way simple threshold protocol in Section HTTl is also a valid delayed observation protocol for 
k = 1. However, because observation is delayed, an agent may repeatedly advance its state after receiving 
a message from itself, which means that the protocol fails to compute the correct predicate in the delayed 
observation model when k > 2. □ 

We observe that if agents do not receive messages from themselves, then predicates in COUNT2 are 
stably computable in the delayed observation model. 

9 Characterization of the Power of the Abstract Model 

To complete the characterizations in Figure we have to demonstrate that each model is limited to the 
indicated power. In Sectional we consider the one-way models. Here we consider the Abstract Model, 
which includes the two-way model and the queued transmission model as special cases, and prove the 
following semilinearity theorem. 

Theorem 6. Every predicate on Pop(S) that is stably computable in the Abstract Model is semilinear. 

Because the two-way and queued transmission models are special cases of the Abstract Model, and both 
models can stably compute all the semilinear predicates over Pop(E), we have the following characteriza- 
tions. 
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Corollary 7. The predicates stably computable in (1) the two-way model of population protocols, or (2) the 
queued transmission model of population protocols are exactly the semilinear predicates on Pop(X). 

Stable computation of a predicate by a two-way population protocol with stabilizing inputs was defined 
in lAAC + 05 1. We do not repeat the definition here, but the idea is that each agent has an input register that 
may change finitely many times over the course of the execution before stabilizing to its final value, and 
the goal is to compute a predicate on the multiset of all the agents' final input values. Because this is a 
more restrictive definition, every predicate stably computable by a two-way protocol with stabilizing inputs 
is stably computable by a two-way protocol with fixed inputs, but whether the converse held was left as an 
open problem. However, in lAAC + 05l it was shown that every semilinear predicate on Pop(E) is stably 
computable by a two-way protocol with stabilizing inputs. Thus we get the following corollary showing that 
stabilizing inputs do not reduce the power of the standard two-way model. 

Corollary 8. The predicates stably computable by two-way population protocols with stabilizing inputs are 
exactly the semilinear predicates on Pop(S). 

To prove Theorem |6j we must show that the support of any stably-computable predicate is a semilinear 
set: in particular, that there is a finite set of base points each attached to a finitely-generated cone such that 
the support is precisely the elements of these cones. The first step, which requires the development of the 
machinery of Section \W\ and is completed in Section ^2 is to show that the support can be decomposed 
into a finite collection of monoid cosets that are not necessarily finitely generated. We then proceed, in 
Sections El and El to show that any such decomposition can be further decomposed into a finite covering 
by cosets of finitely generated monoids, which gives us the full result. 

10 Groundwork 

We assume that tp is a predicate stably computed by a protocol (E, — S, o) in the Abstract Model and 
establish some basic results. These will lead up to the Pumping Lemma of Section fTTI 

10.1 Monoids, Groups, and Semilinearity 

A subset M of Z d is a monoid if it contains the zero and is closed under addition; if it is also closed under 
subtraction, M is a group. A monoid M C 7L d is finitely generated if there exists a finite subset A C M 
such that every element of M is a sum of elements from A. It is a classic result in abstract algebra that 
every subgroup of Z d is finitely generated [Lan02], but submonoids are not always finitely generated. For 
example, the following monoid is not finitely generated. 

M V 2 = {{i,j) £N 2 :i< V2j}. 

A subset H of 7L d is a group coset (resp., monoid coset) if there exists an element v G Z d such that 
H = v + G and G is a group (resp., monoid). 

Then from the definitions in Section l6~Tl we have yet another characterization of linear and semilinear 
sets. A subset L of Z d is linear if it is a coset of a finitely generated monoid in Z d , and is semilinear if it is 
a finite union of linear sets. 
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10.2 Higman's Lemma 

We will make extensive use of some corollaries to Higman's Lemma [Hig52|, a fundamental tool in well- 
quasi-order theory. 

Lemma 9. Every subset ofH d under the inclusion ordering < has finitely many minimal elements. 

Lemma 10. Every infinite subset of~N d contains an infinite chain (i.e., an infinite totally ordered sequence). 

These both follow from the fact that Higman's Lemma implies that N d is a well-quasi-order, that is, a 
set in which any infinite sequence ai, 02, . . . contains elements ai,aj with i < j and ai < aj. The special 
case of Higman's Lemma given in Lemma[9]was proved earlier by Dickson [Die 13 ]. 

10.3 Truncation Maps and Their Properties 

For each k > 1, we define a map from C to C by 

Tfc(c)(e) := min(/c, c(e)) for all ee£. 

This map truncates each component of its input to be at most k; clearly t^(c) < c for all c G C. Two useful 
properties of are that it respects both inclusion and addition. 

Lemma 11. For all c,d £ C and k > 1, if c < d then Tfc(e) < Tfe(d). 

Proof. For each e £ E, we have c(e) < d(e), so min(fc, c(e)) < min(A;, d(e)). Thus Tfe(c) < Tfc(d). □ 

Lemma 12. For all c, d , d £ C and k > 1, if 7fe(c) = Tk(d), then r^(c + d) = Tfc(c' + d). 

Proof. For each e £ E, either c(e) = e/ (e) or both are at least fc. In either case, min(fc, c(e) + d(e)) = 
min(/c, c 7 (e) + d(e)), so Tfc(c + d) = ^(c' + d). □ 

10.4 Truncation and Stability 

Truncation is important because membership of a configuration c in the set of output stable configurations S 
can be determined from a truncate of fixed size. Let U := C\S, the set of output unstable configurations. 

Lemma 13. For all c < d, if c G ti, then d £lA (U is closed upward under inclusion ). 

Proof. Suppose c G U and c < d. Then either (1) 0(c) is undefined, or (2) 0(c) = b, but for some 
configuration d such that c ^ c' either O(c') is undefined or 0(d) 7^ 6. In case (1), 0(d) is undefined 
and d £ IA. In case (2), d = d — c + c d — c + c'. If 0(d) is not defined, then d £ IA. If 0(c') is not 
defined, then 0(d — c + d) is not defined, and d £ IA. If both O(d) and O(c') are defined, we have that 
O(d) = O(c) 7^ 0(d), and 0(d — c + d) is either undefined or equal to 0(d), so d £ IA. Thus is closed 
upwards under inclusion. □ 

Lemma 14. There exists k > 1 smc/z dzaf c £lA if and only ifrk{c) £ IA. 

Proof. By Higman's Lemma, only finitely many elements uj., . . . ,u n are minimal in IA, and because W 
is upwards closed, c G IA if and only if < c for some i. Let fc be the maximum value Uj(e) for all 
i £ {1, ... ,11} and all e £ E. Then Tfc(uj) = Uj for each i. 

Suppose c £ IA. Then n, < c for some i, so Uj = Tfc(uj) < r^(c) by Lemma [TT1 and thus Tfc(c) G ^. 
Conversely, if Tfc(c) G Z^, then Uj < t^(c) < c for some i, and therefore c £ IA. □ 
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Lemma 15. There exists k > 1 such that for all c £ C and b G {0, 1}, we /jave c 6 5j if and only if 
7>. (c) G <S b . 

Proof. By LemmafBJ there exists fc > 1 such that for all c G C, we have c G U if and only if Tfc(c) G Z^. 
Taking the contrapositive, we have c G 5 if and only if 7>.(c) G 5. Since truncation does not affect output, 
the conclusion follows. □ 



10.5 Extensions 

We define a map X from C to subsets of N s as follows. 

X(c) := {x G N E | there exists d > c such that c + x —> d and 7fe(c) = Tk{d)}, 

where k is the constant from the conclusion of LemmalT31 If c G S, then X(c) is the set of inputs by which 
c can be pumped. We call such inputs the extensions of c. We first prove that pumping does not affect stable 
output. 

Lemma 16. If x G Pop(S) and c G S and x c, then ip is constant on x + X(c). 

Proof. If y G X(c), then there exists d G C such that c + y d and rfc(c) = rfc(d). Since c G 5, by 
Lemma [131 we have d € S, and O(c) = 0(d). Thus ^/>(x) = ^(x + y). □ 

We now prove that pumping operations can be composed, i.e., that X(c) is a monoid. 

Lemma 17. X(c) is a monoid for all c G C. 

Proof. We have G X(c), with d = c as a witness. If xi,x 2 G X(c), then there exist d\, d2 such that 

c < d\ and c < d 2 and 775(c) = Tfc(di) = 7>.(d 2 ) and c + xi — > di and c + £2 — * d 2 . Thus 

c + xi + x 2 — >■ di + x 2 = (d\ - c) + c + x 2 — >■ (di - c) + d 2 . 

Taking d := di + d 2 — c, we have c < d and c + xi + x 2 — > d and Tfc(c) = Tfc(d 2 ) = Tfc(c + d 2 — c) 
and by Lemma IT2l 7^(0 + d 2 — c) = r^(di + d 2 — c) = Tfc(d), since Tfc(c) = Tfc(di). We conclude that 
xi + x 2 GX(c). □ 



11 A Pumping Lemma for Stably Computable Predicates 

Given a set of inputs Y C Pop(S), a monoid-coset covering of Y with respect to -0 is a set {(xj, Mj)}j e j 
of pairs of inputs and submonoids of N E such that Y C Uie/( x i + Mi) an d f° r au i G I, we have Xj G 1" 
and tp(xi + Afj) = {V>(xj)}. We say tp admits finite coset coverings if for all Y there exists a finite 
monoid-coset covering of Y with respect to if). The following lemma states that every stably computable 
predicate admits a finite monoid-coset covering. We show later (Theorem I2T1 that any predicate that admits 
finite coset coverings is semilinear. 

Lemma 18. The (stably computable) predicate admits finite coset coverings. 
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Proof. Consider any Y C Pop(S). If Y is a finite set {x%, . . . , x n } then it has a trivial finite covering 
{(xi, 0)}i<j< n ,. So assume Y is infinite. Let y\, 3/2, • • • be any enumeration of Y such that yi < yj implies 
i < j- (For example, fix an ordering of S. Then enumerate the elements of Y ordered by <, breaking ties 
according to lexicographic order.) We define a family of sets Bi C Pop(S) x S inductively as follows. 

B := 0. 

{Bi-i if there exists (x, c) G -Bj-i such that yi G x + X(c) 
Bi-i U s(yO)} u s ( c + 2/j - x )) I c ) e and x < Vi) otherwise, 

where s(d) £ S is any stable configuration reachable from d. It is easy to see by induction on i that, for 
all (x, c) G -Bj, x ^> c, and in the construction, s(d) is applied only to reachable configurations d, so the 
existence of s(d) is guaranteed by the requirements of stably computing a predicate. So, Lemma[T6limplies 
that ip is constant on x + ^(c). Let := |Ji>i Bi- ^ follows from [T71 that {(x, X(c)) \ (x, c) G -B} is a 
monoid-coset covering of Y with respect to ip. We now show that B is finite to prove that this is a finite 
covering. 

Assuming to the contrary that B is infinite, infinitely many different elements of Y appear as first com- 
ponents of elements of B, since each Bi is clearly finite. By Higman's Lemma, there exists an infinite chain 
Z\ < Z2 < ■ ■ ■ of such elements. Our construction guarantees the existence of associated configurations 
{di}i>\ such that (zj, di) G B and di + (z-i+i — Zi) — > di + \ for all i > 1. 

By Higman's Lemma again, there exists an increasing function / such that the sequences (zf^)i>i and 
{df(i))i>i are nondecreasing. Thus the sequence Tk(df^) reaches a maximum and becomes constant at 
some index i = j. Consequently, we have — Zf(j) £ ^(^/(i))> which contradicts the membership 

of(z f{j+1) ,d f{j+1) )mB. □ 

Applying this lemma with Y = ip~ l (l) (the support of ?/0 we obtain a finite family of monoid cosets 
Xi + Mi such that 

= \J(xi + Mi). 

i 

This does not prove semilinearity by itself, since some monoid Mj might not be finitely generated. However, 
every submonoid of 1} is finitely generated, so in the special case of a unary alphabet, we have already that 
ip is semilinear, and therefore regular. 

Corollary 19. Every stably computable predicate over a unary alphabet is semilinear. Thus, over a unary 
alphabet, the stably computable predicates are exactly the semilinear (in fact, regular) predicates. 

For example, the unary predicate that is true if the number of input symbols is a power of 2 (or a prime, 
or any other non-regular predicate) is not stably computable. Another easy corollary suffices to show certain 
other predicates over non-unary alphabets are not stably computable. 

Corollary 20. Suppose ip is a stably computable predicate such that L = is infinite. Then L 

contains an infinite linear subset. 

Proof. By Lemma IT8l there is a finite monoid-coset covering of L. If L is infinite, some (x + M) C L in 
the covering must be infinite. □ 

As an application, consider the set of inputs over the alphabet {a, b} such that the number 6's is the 
square of the number of a's. This is an infinite set with no infinite linear subset, and is therefore not stably 



19 



computable. Using closure results for stably computable predicates we can then show that the set of all inputs 
over alphabet {a, b, c} such that the number of c's is the product of the number of a's and the number of b's 
is not stably computable. The existence of a pumping lemma and the negative results for these particular 
predicates were conjectured in I A AD + 04llAAD + 06 1 . 

12 Proof of the Semilinearity Theorem: Outline 

We are now in a position to give an overview of how we go from the pumping lemma (Lemma IT8l of 
Section^Jto the semilinearity theorem. 
Recall the following set of points in N 2 . 

M V z = {(i,j) :i < V2j}. 

This is a monoid but is not stably computable. To see this, suppose the contrary. By the Pumping Lemma, 
there exist monoid cosets xi + Mi for 1 < i < m such that 

M V2= U (^ + M *)- 
l<i<m 

Let v = (—1, \/2); then x ■ v > for all x G Af/g- Let e = minjjxj • v}. Choose some y G M such 
that < y • v < e. Then for some i, y G xi + Mi, and (y — X{) ■ v = y ■ v — Xi ■ v < e — e = 0. Thus 
for a sufficiently large n G N, (x^ + n(y — xi)) • v < 0, which contradicts the fact that x^ + Mj is a subset 
of M^. The issue here is that the line dividing the positive and negative inputs cannot have an irrational 
slope if the predicate is stably computable. One ingredient of our proof is a generalization of this idea to 
separating hyperplanes. 

However, to be able to use separating hyperplanes, we first must deal with separating "intermixed" 
positive and negative inputs using their images in a finite group. For example, consider the following set of 
points in N 2 , which is stably computable. 

L = :i<j, (i + j) is odd}. 

By first separating the points in N 2 by their images (i mod 2, j mod 2) in the group Z2 x Z2, we get four 
subproblems in which lines suffice to separate the positive and negative points. 

A further issue is that because of the relationship between the monoids X(c) and their cosets x + 
X(c), instead of a single separating hyperplane we have to consider finite sets of parallel hyperplanes, 
which themselves may contain points from the support of ip. These points can be handled by induction on 
dimension, but this requires that the main theorem be generalized to consider the intersection of the support 
of ip and an arbitrary group coset (where we view each hyperplane as a group coset.) We shall prove the 
following theorem by induction on the dimension of the group G; it clearly holds when G has dimension 0, 
i.e., when G is the trivial group. 

Theorem 21. If ip admits finite coset coverings then for any group coset H = xq + G C Z s , we have 
n H is semilinear. 

Note that together with Lemma^Jthis implies Theorem|6j as we can take H = Z s . 
The details of the proof are quite involved and are in Sectional To summarize briefly, the overall 
strategy is: 
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1. By dividing the space into residue classes with respect to appropriately chosen moduli, we can arrange 
for the vectors from the monoids associated with the cover to appear in all-positive and all-negative 
regions separated by hyperplanes. In this part of the proof we extend N s to Z s to make use of the 
fact that all subgroups of Z s are finitely generated. (Section ri3.il ) 

2. We then further map the problem from Z s to M s , and use techniques from convex geometry to show 
that appropriate hyperplanes separating the monoids indeed exist. (Section [l3.2n We obtain a (looser) 
separation by slabs (the space between two parallel hyperplanes) on the inputs by observing that each 
input is displaced a uniformly bounded amount from its corresponding extension vector. 

3. Moving to M E allows for the possibility of separating hyperplanes with irrational coefficients. Ap- 
plying the Pumping Lemma as described above, we show that the resulting separating hyperplanes 
are normal to a vector with rational coordinates and thus correspond to cosets of subgroups of Zp. 
(Section [T33] ) 

4. At this stage, we have shown that the positive inputs to the predicate consist of (a) those inputs in the 
interior of the separated regions, which can by identified first by computing the residue classes of their 
coordinates and then by identifying which of a finite number of polytopes (given by intersections of 
half-spaces with rational coordinates) they appear within, and (b) those inputs that lie in some slab. 
The first class is semilinear as identification of a residue class and identification of membership in a 
particular polytope are both expressible in Presburger arithmetic. The second class is then shown to be 
semilinear by induction on dimension, with the base case of dimension being the trivially semilinear 
case of a single point. (Section ri3.4l ) 

13 Proof of the Semilinearity Theorem: Details 

The proof of Theorem |^ is delayed to Section [13.41 First we describe the process of separating inputs in 
more detail. 

13.1 Separating Intermixed Inputs 

Let ip : Pop(S) — > {0, 1} be a predicate that admits finite coset coverings. Let G be a subgroup of 1? and 
let H = h + G be a coset of G. Take {(etj, Mj)}j 6 j and {(bj, Nj)}j^j to be finite monoid-coset covers 
of ^ _1 (0) n H and H H respectively. Assume without loss of generality that Mi,Nj C G by 

intersecting with G if necessary. Define K(i,j) := TL(M{ n Nj), the group generated by the intersection of 
Mi and Nj. 

Lemma 22. For all i G I and j G J, no coset of K(i, j) intersects both ctj + Mj and bj + Nj. 

Proof. If we suppose the lemma is false, then there exist x G etj + M, and x' G bj + Nj such that (x — x') G 
K(i,j). Because M{ n Nj is a monoid, we can rewrite x — x' as a difference y' — y where y G M, and 
y' G Nj. Thus x + y = x' + y'. The former is in aj + Mi, whereas the latter is in bj + Nj. This contradicts 
the fact that aj + M» and bj + Nj are disjoint (they have different predicate values). □ 

Define 

K:= P| K(i,j). 

K(i,j) has finitely many cosets in G 
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In addition to having finitely many cosets in G, the group K inherits the relevant properties of the groups 
K(i,j) included in its defining intersection. 

Lemma 23. For alii £ I and j G J such that K(i,j) has finitely many cosets in G, no coset ofK intersects 
both a>i + Mi and bj + Nj. 

Proof. Since K(i,j) 5 K, each coset of K is contained in a coset of K(i,j). The result follows from 
Lemma 22. □ 

Since all group cosets are semilinear, we can use membership in the cosets of K to separate those pairs 
of monoid cosets that are intermixed. For the others, we have to take another approach. 



13.2 Separating with Hyperplanes 

Let gi+K, . . . ,g n +K C G be the cosets of K in G. For each £ G {1, . . . ,n} define fl^ := h+gi+K. Note 
that = H. If two monoid cosets ai + Mj and bj + Nj meet both meet some coset h + (g£ + K) C H, 
we show it is possible to separate Hi fi (oj + Mj) from n (6j + TVj) with a hyperplane (except for a set 
of lower dimension). Define I e := {i G I | (a» + Mj) n iJg / 0} and := {j G J | (bj + iVj) n H e / 0}. 
If i G 7^ and j G Jg, then ilg, which is a coset of K, intersects both + Mj and 6j + JVj, so K(i,j) has 
infinitely many cosets in G, by Lemma 1231 

At this point we turn to the methods of geometry. We pass from groups to vector spaces by working in 
the vector space closure WG of G in MP. Instead of monoids, we consider the convex cones they generate: 
the set of nonnegative linear combinations of monoid elements. We connect the geometry to the algebra 
by observing that K(i,j) has finitely many cosets in G if and only if M.K(i, j), the vector space closure of 
K(i,j), is all of M.G. Thus if two monoid cosets are not intermixed, their intersection of their associated 
monoids has strictly smaller dimension than G. This allows us to separate these monoids with a hyperplane. 

Formally, given sets of vectors U and U' , a set of nonzero vectors V distinguishes U and U' if for all 
u G U and v! G U', there exists v G V such that (u • v)(v! ■ v) < 0; that is, either one dot product is zero 
or one is negative and the other is positive. Define Mi := U i6 j Mi and Ni := Ujgj Nj. The goal of this 

subsection is to show the existence of a finite set of vectors V that distinguishes Mi from Ni. The main tool 
we use is the Separating Hyperplane Theorem from convex geometry. Note that int U denotes the interior 
off/. 

Theorem 24. (Separating Hyperplane Theorem [Lay92l) If U and U' are convex subsets of M. d with 
nonempty interiors such that int U H int U' = 0, then there exists v G M. d such that u ■ v < for all 
u G U and v! ■ v > Ofor all u' G U'. 

Unfortunately, Mj and Nj are not convex. Thus we are forced to consider the convex cones that they 
generate. We need Caratheodory's theorem, another result from convex geometry, to verify the seemingly 
trivial fact that the intersection of these cones lies in a proper vector subspace of M.G. 

Theorem 25. (Caratheodory's Theorem fiLay92y ) For any set of vectors Y C R , if x G M+y, then there 
exists a linearly independent subset F'C7 such that x G M+V'. 

Lemma 26. For all i £ Ie and j G Ji, the set Z = M + Mj n M. + Nj is contained in a proper vector subspace 
ofRG. 
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Proof. Suppose to the contrary. Then the vector subspace WZ is all of RG and has a basis {z\ , . . . , zj} C Z. 
By perturbing this basis to have rational coordinates, we can assume without loss of generality that z s G QG 
as well for all s G {1, . . . , d}. 

By Theorem |25j for each s, there is a linearly independent set Y s C Mj such that z s G R+l^. When 
we write each z s as its unique linear combination of elements in Y s , we see by linear algebra over QG 
that in fact z s G Q+Mj. Repeating this argument with Nj yields that z s G Q+Mj n Q+Nj. We clear 
denominators to find numbers m s such that m s z s G Mj n Nj. The set {m s z s }, however, is a basis for EG, 
which contradicts the fact that M.K (i, j) is not all of RG. □ 

Lemma 27. For all i G If, and j G Ji, there exists a nonzero vector v such that {v} distinguishes Ig and J#. 

Proof. If either Mj or Nj is contained in a proper vector subspace of EG, then take v to be normal to that 
subspace. 

Otherwise, consider the sets U := IR+Afj and U' := M. + Nj. The intersection of their interiors is both 
open and contained in a proper vector subspace of KG. Thus U and U' have no interior point in common. 
Therefore, by Theorem l24l there exists v G MG such that for all u G U, we have u ■ v < 0; and for all 
v! G C/', we have u' ■ v > 0. It follows that {w} distinguishes Mj and iVj. □ 

To obtain a set of vectors that distinguish Mi and Ni, we put together all of the individual distinguishing 
vectors. 

Lemma 28. For all 1 < I < n, there exists a finite set of vectors V that distinguishes Mi and N& 

Proof. The set V := {v(i, j) \ i G h and j G Je} distinguishes Mi and A^, where v(i, j) is the vector from 
Lemmal27lsuch that {v(i,j)} distinguishes Mj and iVj. □ 

Combining results in this section and the previous one, we have some powerful criteria for determining 
the predicate value of an input. 

Lemma 29. Let V be a set of vectors that distinguishes Mi and Ni. Suppose x G Mi and y G Hi are such 
that for all j G Ji and v G V, we have (x • v)((y — 6j) • v) > 0. Then ip{y) = 0. 

Proof. Suppose to the contrary that ip(y) = 1. Then there exists j G Ji such that (y — bj) G iVj. The set V, 
however, fails to distinguish x and y — bj, which is a contradiction. □ 

Clearly, this lemma has an analogous counterpart that establishes sufficient conditions for tp(y) = 1. 
13.3 Achieving Rationality 

The chief obstacle yet to be overcome is that a distinguishing set of vectors might include vectors with 
irrational coordinates. In order to rule out predicates like tp(r, s) := [r < (y/2)s], we need to show that we 
can always distinguish Mi and by vectors with integral coordinates. We must use for a second time the 
fact that tp admits finite coset covers. 

Lemma 30. For all £ there exists a finite set of vectors from TP that distinguishes Mi and Ni. 

Proof. Since we can clear denominators, it is enough to find a set of vectors in Q s that distinguishes Mi 
and Ni. By Lemma |2"F1 there exists a finite set of vectors V that distinguishes Mi and N(. Assume that 
V \ Q E has minimum cardinality, that is, as few vectors in V have irrational components as possible. To 
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avoid a special case later, we assume without loss of generality that V contains the standard basis £ of R E . 
We show that this set V contains only vectors in Q E . 

Suppose to the contrary that there exists v G V \ Q s . By assumption, the set V := V \ {v} cannot 
distinguish Mg and Ng. Thus there exist i £ 7| and j G and x G Mj and y G iVj such that for all w' G V 
we have (x ■ v')(y ■ v') > 0. 

We consider two cases. In the first case, for all choices of x and y we have (x ■ v)(y ■ v) = 0. Then 
at least one vector in each problem pair is normal to v. By linear algebra over Q s , there exists a vector 
v' G Q s such that if w G G is normal to v, then w is normal to v'. Thus V U {V} distinguishes Mg and Ng, 
which is a contradiction, since (V' U {«'}) \ Q s has fewer elements than V \ Q s . 

In the second case, we have x and y such that (x • v')(y ■ v') > for all v' G V and (x ■ v)(y ■ v) < 0. 
Assume without loss of generality that x-v<0<y-vby taking —v instead of v if necessary. Let 
Q := {w G RG | u' • it? > for all v' G V and > for all q G £}. Clearly is an open set. Also, 
y G $7, since by the assumption that £ C V we have y(g) > for all q G S. Given that O is a nonempty 
open set, we can extend x, y to a basis w\ = x,W2 = y, ■ ■ ■ , w m such that io s G for all s > 2. By 
perturbing each w s slightly to have rational coordinates and clearing denominators, we assume without loss 
of generality that w s G Q,Pi K. There exists s such that (w s ■ v) / (w\ ■ v) is irrational, since otherwise some 
scalar multiple of v belongs to Q s . 

In consequence N(x • v) + N(w s ■ v) is dense in R, so we can find sequences of positive integers m t and 
m' t such that 

mt(x ■ v) + m t (w s ■ v) 

is a negative monotone increasing sequence of real numbers approaching as t approaches infinity. For all 
v' G V, the points (m t x + m' t w s )t>i lie on the same side of the hyperplane normal to v, and as a sequence 
they approach the hyperplane normal to v arbitrarily closely. By another application of Higman's Lemma, 
there is an increasing function / such that (nif^, m 'f^) is an increasing sequence. 

Let z G (dj + Mi) n H£. There exists some constant c > such that for each r, the points ((z + (c + 
m f(t)) x + m 'f^w s ) — b r )t>\ all lie on the same side of each hyperplane as x. It is easily verified that each 
of these points belongs to Hg. Thus by Lemma l29l ip(z + (c + rrif^x + m'j.^w s ) is constantly 0. Apply 
the pumping lemma (Lemma[T8l again to these inputs to obtain a finite cover. Then there exist t\ < ti such 
that (mt 2 — m tl )x + {m' t2 — m' tl )w s G P, where the monoid coset (z + m tl x + m t2 w s ) + P belongs to the 
cover. Pumping z + (c + m tl )x + m' tl w s by a sufficiently large multiple of (mt 2 — )x + (m' t2 — m' t )w s 
yields an element z' such that tp(z') = 0, but for each r, we have that z' — a r is on the same side of each 
hyperplane as w s , which contradicts Lemma |29] □ 

13.4 Proof of TheoremEE 

We can now prove Theorem |^ by induction on the dimension of G (the cardinality of the largest linearly 
independent subset of G.) 

Proof. If the dimension of G is zero, then H is a single point and the result holds. If the dimension of G is 
greater than zero, then by Lemmas 1231 and BUI there exist a group K and finite distinguishers ^ C Z s for 
all cosets Hg of K in H. 

For each distinguishing vector v G Vg, consider the set of points x G Hg such that it is not that the case 
that the following numbers are either all negative or all positive: (x — Oj) -v for i G Ig and (x — bj) ■ v for 
j G Jg. This set has finite width in the direction of v. Thus it can be written as the union of finitely many 
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cosets of a group of smaller dimension. The key to the induction is that any point not in the union of these 
sets over the different x satisfies the hypotheses of one of the variants of Lemmal29l 
Define the sets 

B := [J{x £ He \ 3y £ Ne such that ((x - bj) ■ v)(y ■ v) > for all j £ Jg_ and v £ Vg} 

i 

B' := [J{x E Hi | fly £ Mg such that ((x - 04) ■ v){y ■ v) > for all i £ Ig and v £ Ve}. 

i 

By Lemma l29l we have B C ^> -1 (l) C B'. It is not difficult to verify that B and B' are semilinear. 
Moreover, B' \ B is a union of finitely many group cosets of dimension less than G. It follows by inductive 
hypothesis that ip~ l {l) n {B' \ B) is semilinear, and thus that tp itself is semilinear. □ 

14 Characterizations of the One- Way Models 

In this section, we complete the characterizations of the one-way models in Figure by showing that they 
are limited to the indicated power. 

14.1 Immediate and Delayed Transmission 

We first consider the immediate and delayed transmission models to prove the following converse to Theo- 
rem |3] 

Theorem 31. Let ip be a predicate that is stably computable by an immediate or delayed transmission 
protocol. Then tp is in SLIN n coreMOD. 

Thus, for example, the comparison predicate, true if there are more a's than fo's in the input, is not stably 
computable in the immediate or delayed transmission model, because it is not in coreMOD. Intuitively, 
the weakness of delayed transmission compared with queued transmission is in the inability of a receiver to 
refuse messages temporarily; in effect, by delivering a number of copies of some message to a receiver and 
and forcing it back into the same state, we cause the whole collection of messages to "disappear" from the 
computation. 

Because a delayed transmission protocol is a special case of a queued transmission protocol and an 
immediate transmission protocol is a special case of a two-way protocol, Corollary shows that ip is in 
SLIN. To see that ip is also in coreMOD requires some preliminary lemmas. Consider any delayed or 
immediate transmission protocol that stably computes rp, and consider any nonempty subset £' of X. 

To unify the treatment of the two kinds of protocols, we assume that in a delayed transmission protocol, 
the sender simply sends its current state; thus, we need not distinguish between states and messages in 
our description. Formally, in this case the set of messages consists of a disjoint copy of the set of states, 
distinguished by the phrases "the state q" and "the message q{." In the case of immediate transmission, an 
interaction (p, q) ^ (^i(p), foip, <?)) is described as the sender sending message p and going to state Si(p), 
and the receiver receiving message p and going to state (52 (p, q)- 

We let Q' denote the set of states that appear in configurations reachable from inputs that contain only 
symbols from For states q, q' £ Q' of the protocol, we say that q can reach q' if there is some finite 
sequence of messages (from Q') sent and received by an agent in state q that enable it to enter state q'. 
Formally, q can reach q' if there is a sequence of states q = q%, 52, • • • , qk = Q 1 sucn that, for 2 < i < k, 
either qi = <5 s (gj_i) or qi = 5 r (p, for some message p £ Q'. 
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The following lemma shows that, for any message p, a sufficient number of copies of p can be "absorbed" 
by an agent in some state q, returning that agent to state q. 

Lemma 32. Fix any message p G Q'. Define f p (q) = 5 r (p, q). There exists a state q G Q' and a positive 
integer n such that (q) = q. 

(2) 

Proof. For any state r G Q', the sequence of states r, f p (r), fp (r), ... in Q' must be eventually periodic 
of some period n. Choosing q to be any state in the periodic part, we see that fp (q) = q. □ 

If n is a positive integer and q\,q 2 G Q' are states, we say that qi and q 2 are n-substitutable if there 
exist an input x containing only symbols from £' and a configuration b of states, such that the configurations 
c = nq\ + b and d = nq 2 + b are reachable from I(x). We note that if q\ and q 2 are n-substitutable, then 
they are mn-substitutable for any positive integer m. We define two states qi,q 2 G Q' to be substitutable if 
there is some positive integer n such that they are n-substitutable. Substitutability is reflexive and symmetric 
by definition; we now show it is transitive. 

Lemma 33. Let qi,q 2 ,q3 G Q' be states and assume that q\ and q 2 are substitutable and q 2 and q% are 
substitutable. Then q\ and q% are substitutable. 

Proof. For some input x containing only symbols from configuration b of states and integer n, the 
configurations c = nq± + b and d = nq 2 + b are reachable from I(x). Similarly, for some input y containing 
only symbols from configuration b' of states and positive integer m, the configurations c' = mq 2 + b' 
and d' = mq^ + b' are reachable from I{y). 

Consider the input z = mx + ny, which contains only input symbols from From I{z) there is a 
computation reaching mc + nc', which is equal to mnq\ + (mnq 2 + mb + nb'), and also a computation 
reaching md+nd! ', which is equal to mnq^ + {mnq2 + mb + nb'). Thus qi and q% are mn-substitutable. □ 

Now we show that reachability implies substitutability. 

Lemma 34. Ifqi,q 2 G Q' are states such that q\ can reach q 2 then q\ and q 2 are substitutable. 

Proof. Because substitutability is transitive, it suffices to consider the case in which q 2 is reachable in one 
step from q\. For every state q G Q', we define c q to be any configuration of states containing q that is 
reachable from an input containing only symbols from We consider two cases. 

If q\ reaches q 2 by a send step, then by Lemma^we may choose a state ^3 G Q' and a positive integer 
n such that f^\qz) = 53. (Intuitively, this means an agent in state 53 will be back in (73 after receiving n 
copies of message q\.) We choose b = n(c qi — qi) + c q3 , and let c = nq\ + b, so that c = nc qi + c qz . Then 
c is reachable from I(x) for some input x containing only symbols from 

And from c we may have each of n agents in state q\ transmit a message (and reach state q 2 ) to a single 
agent in state q%, which will again be in state q^ after receiving the n copies of q\. Formally, it is easy to see 
by induction on j that c ^> (n — j)q% + jq 2 + b — q% + f q {\q3) for < j < n. Taking j = n, we have that 
d = nq 2 + b is reachable from c, and therefore from I(x), so q\ and q 2 are substitutable. 

Suppose q± reaches q 2 by a receive step, say of message q% G Q'. Let q^ be the state reached from state 
(73 after a send. Then by Lemma|32j there is a state q$ G Q' and a positive integer n such that fqy (q$) = (75. 
(This means that after receiving n copies of message q^ an agent that starts in state q$ will be back in state 
(75.) We choose 

b = n(c qi - qi) + n(c q3 - q 3 ) + nq A + c qs , 
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and and let 

c = nqi + b = nc qi + n(c ga - q 3 ) + rag 4 + c q5 . 

Now d = nc qi + nc^ + c q5 is reachable from I(x) for some input x containing only symbols from It 

is easy to see by induction on j that, for < j < n, d A nc qi + nc q3 — jqs + j</4 + c qs — q§ + f q J 3 \q5) 
by a sequence of steps in which j agents in state q% send a message (and go to state q^) to a single agent 
that started in state (75. Taking j = n, we see that d — > nc 91 + nc 93 — ra(/3 + nq^ + c q5 = c. Also, 
d = n<72 + b = n(c qi — q{) + nq2 + n(c q3 — q$) + nq± + c q5 is reachable from d by a computation in which 
we pair up n agents in state q^ with n agents in state q\ and in each of the n pairs have the agent in state q% 
send a message to the agent in state q\, transforming the sender into state and the receiver into state q^. 
Thus, in this case also, q\ and 52 are substitutable. □ 

Thus we have the following pumping lemma for predicates stably computable by immediate and delayed 
transmission protocols. 

Lemma 35. For every input symbol a G £' there exist positive integers k and n such that for every input 
y £ Pop(S) that is k-rich with respect to y and y + na are both accepted or both rejected. 

Proof. Let k be the constant in Lemma IT31 such that k -truncates are sufficient to determine membership 
in the set S of output stable configurations for the protocol. We choose k% to be \Q'\ (ko — 1) + 1. 

Let a be any input symbol from £' and let q = i(cr), the initial state associated with a. Let R C Q' 
be the set of states that q can reach, and consider any q' G R. By Lemma l34l q and q' are n q > -substitutable 
for some positive integer n q i . Let n be the least common multiple of the n q > for all q' G R; q and q' are 
n-substitutable. That is, there exists an input x q i containing only symbols from £' and a configuration of 
states b q i such that the configurations c q > = nq + b q i and d q > = nq' + b q > are reachable from I{x q i). 

Let x be the sum of all x q > over q' G R. We choose &2 to be the maximum multiplicity of any input 
symbol in x. Let k = max(A:i, /C2) and let y be any input that is A;-rich with respect to Then y > x and 
y contains only symbols from £'. 

Consider a computation from I{y) that first takes I(x) to the sum s = X^'eR <V anc ^ tnen proceeds to 
an output stable configuration e. Since y is A; -rich with respect to there are at least k > k\ agents. By 
the pigeonhole principle, some state q' appears with multiplicity at least ko in e. Note q' G R. 

Now from I(y + na) = I(y ) + nq we consider a computation that takes I(x — x q i ) to s — c q i and I(x q i ) 
to d q t 7 giving 

I(y - x) +nq+ (s - (nq + b q >)) + nq 1 + b q > = I(y - x) + s + nq' . 

Now we continue by running I(y — x) + s to e, giving e + nq', which is output stable because Tfc (e) = 
Tfc (e + nq 1 ). Thus y and y + na are both accepted or both rejected. □ 

Now we can conclude the proof of Theorem l3T1 

Proof. For each alphabet symbol a G by Lemma l35l there exist integers k a and n a such that for all 
inputs y that are /co-rich with respect to y + n CT cr is accepted if and only if y is accepted. Let k be the 
maximum of the k a 's over cr G Then the acceptance or rejection of an input y that is fc-rich with respect 
to £' depends only on the values of the number of occurrences of a modulo n a , which implies that tp is 
/c-similar with respect to £' to a predicate in in MOD. Because £' was an arbitrary nonempty subset of E, 
this shows that ip G coreMOD. □ 
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14.2 Immediate Observation 



In the immediate observation model, transitions are of the form (p, q) ^ (p, q') and there is no multiset 
of undelivered messages. We have shown in Theorem |4] that for any constant k, an immediate observation 
protocol can count the number of copies of each input symbol up to k, However, this is also the extent of its 
power. 

Theorem 36. Let ip be a predicate that is stably computable by an immediate observation protocol. Then 
ip £ COUNT*. 

Proof. Let k be the constant in Lemma fR] such that fc-truncates are sufficient to determine membership 
in the set S of output stable configurations. Assume that x is an input such that some input symbol a 
occurs with multiplicity at least k' = \Q\(k — 1) + 1 in x. Let cq, c\,C2, ■ ■ ■ , c m be an execution from the 
initial configuration cq = I(x) to an output stable configuration c m . Then, c, = q_i — pi + p\ for some 
Pi, Pi € Q- We define Sj(j) inductively to represent the state of the jth agent with input a in Cj, as follows. 
Let so(j) = t(cr). If the multiset {sj_x(J) : 1 < j < k'} is contained in q, then = Sj_i. Otherwise, there 



By the pigeonhole principle, the multiset {s m (j) | 1 < j < k'} contains some state q' with multiplicity 
at least k. Choose j' such that s m {j') = q'. We introduce a "clone" of this agent into the execution. 
Formally, we show by induction that I(x + a) — > Cj + Si(j'). When i = 0, I(x + a) = cq + so(j'). 
Assume I(x + a) Ci-\ + Si^i(j'). If qi(j') = Si-i(j'), then the claim is clearly true. Otherwise, 
Ci + Si(j') = Cj_i — pi + 2p[, which is reachable from Cj_i + Sj_x(i') = Ci-\ +Pi by having two agents in 
state pi change to state p[ by observing some state in Cj_i — pj. 

Thus, I(x + a) —* c m + q' . Because the multiplicity of q' in c m is at least k, Tk(c m ) = T^(c m + q'). 
Therefore, since c m is output stable, so is c m + q'. Moreover, c m + q' has the same output as c m , so 
ijj(x) = ip(x + a). Because this holds of any input symbol a of multiplicity at least k' in x, we have 



We may also consider a variant of the immediate observation model in which an agent may interact with 
itself, that is, a rule (p, p) ^ (p, q) can be applied to a single agent in state p to change it to state q. This is 
the model with mirrors. The two versions of the model are equal in power, as they can simulate each other, 
using bit-flipping protocols to avoid or permit self-interactions. 

Theorem 37. The same predicates are stably computable by immediate observation protocols in the models 
with and without mirrors. 

Proof. We may assume that n, the population size, is at least 3, since any predicate on 3 or fewer agents is 
computable in either model; this case can be detected and handled separately in either kind of protocol. 

Given an immediate observation protocol that stably computes a predicate ip in the model without mir- 
rors, we can derive another protocol that stably computes tp in the model with mirrors. For every old state 
q we introduce a new state q' and for every old transition (p, q) h-> (p, r), where p ^ q, we introduce vari- 
ants of the transition with all combinations of primed and unprimed states p, q, and r. We replace every 
old transition (p,p) i— ► (p,q) with four new transitions: (p,p) i— ► (p,p') and (p',p') i— > (p',p), as well as 
ip,p') i— > (p, q) and (p',p) i— > (p',q). In the mirrored model, this allows an agent to flip back and forth 
between p and p' by itself, but to leave these two states, it must interact with someone other than itself 
(witnessed by having different "primation"). 



is some j such that Sj_i(j) = pi, and we define Sj(j') 




Pi if j = 3 

s i-i{j) otherwise. 



ip £ COUNTS C COUNT,. 



□ 
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For the other direction, given an immediate observation protocol in the model with mirrors that stably 
computes a predicate ip, we can again introduce primed and unprimed versions of each state. For each 
ordered pair of states p and q, we have rules (p, q) h-> (p, q') and (p, q') \— > (p, q), which allow a state to flip 
between primed and unprimed as long as there is at least one unprimed state. Because the input states are 
unprimed, these rules cannot eliminate the last unprimed state. In addition, for every rule (p, q) i— > (p, r) 
with p ytz q in the protocol with mirrors, there is a rule (p', q) i— > {p' , r) in the protocol without mirrors; this 
allows steps involving two agents in different states to be simulated by priming the initiator, unpriming the 
responder, and taking the step. For every rule (p, p) i— ► (p, r) in the protocol with mirrors, there are rules 
(q',p') i— > (q',r') for every original state q. If a step involves two agents in state p, it can be simulated 
by priming both agents and taking the step. If a step involves one agent in state p, it can be simulated by 
priming that agent (to get p') and any other agent (to get q') and taking the step. Note that this simulation 
can be carried out if there are at least three agents in the population because there is at least one unprimed 
agent in every configuration reachable from an input configuration. □ 

14.3 Delayed Observation 

Here, we prove the converse of Theorem |5j showing that the delayed observation model is the weakest of 
the one-way models we defined. 

Theorem 38. Suppose tp is stably computed by a delayed observation protocol. Then ip is in COUNTj. 

Proof. We show that for any input x, if a £ x then ip(x + a) = ip{x), which implies that ip is completely 
determined by the presence or absence of each input symbol and hence is in COUNT!. 

Consider the finite graph whose nodes are configurations reachable from I{x) that contain no messages 
in transit, with a directed edge from c to d if c — » d . A final strongly connected component of this graph is 
one from which no other strongly connected component of the graph is reachable. From I(x) we can reach 
a configuration in a final strongly connected component T of this graph. Let T denote all the configurations 
d, including those with undelivered messages, such that c — > d for some c 6 f. For any configurations d 
and d' in T, d —> d! by first delivering all messages in d. This implies that all configurations in T are output 
stable. 

The set T of states that occur in configurations in T is closed, that is, if p, q G T and (p, q) \— > (p, q'), 
then q' G T. To see this, assume not. Then, take a configuration c in T that contains p and let an agent in state 
p send a message, putting p into messages in transit. Now mimic a computation from d to a configuration 
d' in T containing q, leaving the message p undelivered. Then deliver p to an agent in state q, arriving at a 
configuration in JF containing q', a contradiction. 

Now consider any a in x. Consider an execution that begins in I(x) and ends in an output stable 
configuration c in T. There must be a sequence of states qo , q\ , . . . , q m where go = L {&)> Qm appears in 
c, and (p^ qi-i) ► {pi,qi) for some state pj that appeared in some configuration during the execution. 
Starting from the configuration I(x + a) = I(x) + qo, we can reach a configuration c + qo that also has one 
additional copy of each message p\ , . . . , p m left in transit. By delivering all of the m messages to the agent 
in state qo in order, we reach the configuration c + q rn . Because T is closed and the states of c + q m are all 
in T, c + q m is output stable and therefore ip(x + a) = ip(x). □ 

If we assume that no agent ever receives its own message, then the power of the model increases only 
slightly: it becomes possible for an agent in a unique state to observe that it never encounters a twin, and the 
stably computable predicates are COUNT2 in this case. The proof is a straightforward extension of the 
proof of Theorem l38l 
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15 Local Fairness Is Weak Even with Unbounded States 



In this section, we consider a strongly anonymous message-passing model with the following local fairness 
condition: if some agent sends a particular message m infinitely often, then each agent receives message m 
infinitely often. This model turns out to be surprisingly weak. Even if the states of processes and the lengths 
of messages may grow without bound, protocols in this model cannot distinguish two multisets of inputs 
if the same set of values appears in each. Since this model subsumes the one-way finite-state population 
protocol models, this result supports the choice of the stronger global fairness condition assumed in the rest 
of the paper. 

Theorem 39. Let £ denote the (finite or countably infinite) set of possible input values. A predicate ip on 
finite nonempty multisets of elements from £ is stably computable in the asynchronous message-passing 
model with the weak fairness condition if and only ifip is completely determined by the set of input values 
present in the initial configuration. 

Proof. We describe a protocol in which each agent eventually determines the set of all the inputs that occur 
in the initial configuration, and therefore the correct value of ip. The state of each agent is the set consisting 
of its initial input value together with every value that has occurred in a message it has received. Whenever 
an agent runs, it sends its current state. Whenever an agent receives a message, it updates its state to be the 
union of its previous state and the set of values in the message. 

Clearly every message sent is a subset of the set of input values in the initial configuration, so there 
are only finitely many possible messages in each computation. Every message sent by an agent with input 
value a contains the element a, and it sends infinitely many messages, so eventually every agent receives 
a message containing a. Thus, the state of every agent eventually consists of the set of values in the input 
configuration, and each outputs the correct value of ip. 

For the converse, assume that we have a protocol that stably computes a predicate tp, and let x and x' 
be any two nonempty multisets of values from £ such that the same set of values appears in each. Let 
n = \x\ and n' = \x'\. Let cq and c' be initial configurations corresponding to inputs x and x', respectively. 
We construct two executions a and a' starting from cq and c' . Let mi, ni2, ... be an arbitrary sequence of 
messages where every possible message appears infinitely often. We construct the executions a and a' in 
phases, where phase i will ensure that message mi gets delivered to everyone if that message has been sent 
enough times. Let Cj and d i be the configurations of a and a' at the end of phase i. 

Our goal is to prove the following claim: for all i > and for all ex e S, the state in a of each agent 
with original input a is the same as the state in d i of each agent with original input a. Assume that we have 
constructed the first i — 1 phases of the two executions so that the claim is satisfied. Suppose we run all 
processes in lock step from Cj_i and c' i _ l without delivering any messages. There are two cases. 

Case (i): Eventually, after rounds, the run from q_i will have at least n copies of mi in transit and, 
after rounds, the run from c' i _ l will have at least n' copies of rrii in transit. Then, the ith phase of a and 
a' is constructed by running each agent for max(rj, rounds without delivering any messages, and then 
delivering one copy of mi to every agent. This ensures the claim will be true for Cj and d { . 

Case (ii): Otherwise, we allow every agent to take one step without delivering any messages. (This 
clearly satisfies the claim for Cj and c' { .) 

It remains to show that both a and a' satisfy the weak fairness condition, and then it will follow from 
the claim that ip(x) = ip(x'). First, notice that every agent takes infinitely many steps in a and a'. If some 
agent v sends a message m infinitely many times in a or a', it will also be sent infinitely many times by an 
agent with the same input value in the other execution (since an agent with a particular input experiences the 
same sequence of events in both executions). Suppose m is never delivered after phase i to some agent w 
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in one of the two executions. Eventually, there will be n copies of m in transit in Cj for some j > i and n! 
copies of m in transit in C'a, for some j' > i. Consider the first occurrence of m in the sequence mi, m2, • • • 
that comes after rrij and m'j. During the corresponding phase, m will be delivered to every agent, including 
w, a contradiction. Thus, a and a' satisfy the weak fairness condition. □ 

16 Conclusions and Discussion 

We have shown that the predicates stably computable by population protocols in the all-pairs communi- 
cation graph are semilinear, answering the main open question in lAAD + 04llAAD + 06l . This result also 
shows that the model of population protocols with stabilizing inputs, introduced in I A AC + 05ll . is equal in 
computational power to the standard model of population protocols in the all-pairs communication graph, 
resolving another open question. 

Our semilinearity proof is given for an abstract model that includes not only population protocols, but 
generalizations permitting rules that replace one finite multiset of elements of a configuration with another 
finite multiset of elements. Thus, even a generalization of population protocols in which rules may add 
or delete agents or involve interactions between more than two agents will stably compute only semilinear 
predicates, answering a question in I A AD + 03l . 

We have introduced several models of one-way communication in population protocols: queued trans- 
mission, immediate and delayed transmission and immediate and delayed observation, and exactly charac- 
terized the classes of predicates stably computable in these models in the all-pairs communication network 
by natural subclasses of the semilinear predicates. These one-way models are more closely related to asyn- 
chronous message-passing models, and illuminate the effects of capabilities such as the ability to refuse to 
accept incoming messages temporarily. 

Another natural variant of the population protocol model considers "reversing moves" and requires that 
a protocol stably compute a predicate despite the possible presence in an execution of a finite number of 
reversing moves, that is, steps in which a rule (p, q) i— > (j/, q') is used in reverse: (p' , q') h-> (p, q). It is not 
difficult to show that the basic protocols for modulo and threshold predicates are resistant to such reversing 
moves, and therefore that all the semilinear predicates can be computed by protocols resistant to reversing 
moves. Thus, requiring such resistance does not reduce the computational power of population protocols in 
the all-pairs communication graph. 

Despite promising results for population protocols in restricted communication graphs |AAC + 51. much 
more remains to be understood about their computational power. In particular, the computational power of 
one-way protocols in restricted communication graphs has not been studied. 

17 Acknowledgments 

This research was carried out while the third author was an undergraduate at the University of Rochester. The 
authors would like to thank the reviewers of the extended abstracts on which this paper is based [ AAE06b 
AAER05 ] for their thoughtful comments and suggestions. 

References 

[AAC + 05] Dana Angluin, James Aspnes, Melody Chan, Michael J. Fischer, Hong Jiang, and Rene Per- 
alta. Stably computable properties of network graphs. In Viktor K. Prasanna, Sitharama Iyen- 



31 



gar, Paul Spirakis, and Matt Welsh, editors, Distributed Computing in Sensor Systems: First 
IEEE International Conference, DCOSS 2005, Marina del Rey, CA, USA, June/July, 2005, 
Proceedings, volume 3560 of Lecture Notes in Computer Science, pages 63-74. Springer- 
Verlag, June 2005. 

[AAD+03] Dana Angluin, James Aspnes, Zoe' Diamadi, Michael J. Fischer, and Rene Peralta. Urn au- 
tomata. Technical Report YALEU/DCS/TR-1280, Yale University Department of Computer 
Science, November 2003. 

[AAD+04] Dana Angluin, James Aspnes, Zoe Diamadi, Michael J. Fischer, and Rene Peralta. Compu- 
tation in networks of passively mobile finite-state sensors. In PODC '04: Proceedings of the 
Twenty -Third Annual ACM Symposium on Principles of Distributed Computing, pages 290- 
299. ACM Press, 2004. 

[AAD + 06] Dana Angluin, James Aspnes, Zoe Diamadi, Michael J. Fischer, and Rene Peralta. Computa- 
tion in networks of passively mobile finite-state sensors. Distributed Computing, 18(4):235- 
253, March 2006. 

[AAE06a] Dana Angluin, James Aspnes, and David Eisenstat. Fast computation by population proto- 
cols with a leader. Technical Report YALEU/DCS/TR-1358, Yale University Department of 
Computer Science, May 2006. Extended abstract to appear, DISC 2006. 

[AAE06b] Dana Angluin, James Aspnes, and David Eisenstat. Stably computable predicates are semi- 
linear. In Proceedings of the 25th ACM Symposium on Principles of Distributed Computing, 
pages 292-299, July 2006. 

[AAER05] Dana Angluin, James Aspnes, David Eisenstat, and Eric Ruppert. On the power of anonymous 
one-way communication. In Ninth International Conference on Principles of Distributed Sys- 
tems, pages 307-318, December 2005. 

[AAFJ05] Dana Angluin, James Aspnes, Michael J. Fischer, and Hong Jiang. Self-stabilizing popula- 
tion protocols. In Ninth International Conference on Principles of Distributed Systems (pre- 
proceedings), pages 79-90, December 2005. 

[AGM02] Hagit Attiya, Alia Gorbach, and Shlomo Moran. Computing in totally anonymous asyn- 
chronous shared memory systems. Information and Computation, 173(2):162— 183, March 
2002. 

[Ang80] Dana Angluin. Local and global properties in networks of processors. In Proceedings of the 
12th ACM Symposium on Theory of Computing, pages 82-93, 1980. 

[ASS02] James Aspnes, Gauri Shah, and Jatin Shah. Wait-free consensus with infinite arrivals. In 
Proceedings of the 34th ACM Symposium on Theory of Computing, pages 524-533, 2002. 

[Bai75] Norman T. J. Bailey. The Mathematical Theory of Infectious Diseases, Second Edition. 
Charles Griffin & Co., London and High Wycombe, 1975. 

[BPSV06] Harry Buhrman, Alessandro Panconesi, Riccardo Silvestri, and Paul Vitanyi. On the im- 
portance of having an identity or, is consensus really universal? Distributed Computing, 
18(3): 167-176, 2006. 



32 



[BV99] Paolo Boldi and Sebastiano Vigna. Computing anonymously with arbitrary knowledge. In 
Proceedings of the 18th ACM Symposium on Principles of Distributed Computing, pages 173— 
179, 1999. 

[BV01] Paolo Boldi and Sebastiano Vigna. An effective characterization of computability in anony- 
mous networks. In Distributed Computing, 1 5th International Conference, pages 33-47, 2001. 

[DF01] Zoe Diamadi and Michael J. Fischer. A simple game for the study of trust in distributed 
systems. Wuhan University Journal of Natural Sciences, 6(l-2):72-82, March 2001. Also 
appears as Yale Technical Report TR-1207, January 2001. 

[DGFGR06] Carole Delporte-Gallet, Hugues Fauconnier, Rachid Guerraoui, and Eric Ruppert. When birds 
die: Making population protocols fault-tolerant. In Proceedings of the Second IEEE Interna- 
tional Conference on Distributed Computing in Sensor Systems (DCOSS '06), pages 51-66, 
2006. 

[Die 13] Leonard Eugene Dickson. Finiteness of the odd perfect and primitive abundant numbers with 
n distinct prime factors. American Journal of Mathematics, 35(4):413-422, October 1913. 

[DK65] D. J. Daley and D. G. Kendall. Stochastic rumours. Journal of the Institute of Mathematics 
and its Applications, 1:42-55, 1965. 

[ES94] Omer Egecioglu and Ambuj K. Singh. Naming symmetric processes using shared variables. 
Distributed Computing, 8(1): 19-38, 1994. 

[FR03] Faith Fich and Eric Ruppert. Hundreds of impossibility results for distributed computing. 
Distributed Computing, 16(2-3): 121-163, September 2003. 

[Gil92] Daniel T. Gillespie. A rigorous derivation of the chemical master equation. Physica A, 
188:404-425, 1992. 

[GR05] Rachid Guerraoui and Eric Ruppert. What can be implemented anonymously? In 19th Inter- 
national Symposium on Distributed Computing, pages 244-259, 2005. 

[Hig52] Graham Higman. Ordering by divisibility in abstract algebras. Proceedings of the London 
Mathematical Society, 3(2):326-336, 1952. 

[HP78] J. Hopcroft and J. Pansiot. On the reachability problem for 5-dimensional vector addition 
systems. Theoretical Computer Science, 8(2): 135-159, 1978. 

[IDE04] Oscar H. Ibarra, Zhe Dang, and Omer Egecioglu. Catalytic P systems, semilinear sets, and 
vector addition systems. Theor. Comput. Set, 3 12(2-3): 379-399, 2004. 

[JT90] Prasad Jayanti and Sam Toueg. Wakeup under read/write atomicity. In Distributed Algorithms, 

4th International Workshop, volume 486 of LNCS, pages 277-288, 1990. 

[KOPS00] Shay Kutten, Rafail Ostrovsky, and Boaz Patt-Shamir. The Las- Vegas processor identity prob- 
lem (How and when to be unique). Journal of Algorithms, 37(2):468^494, November 2000. 

[Lan02] Serge Lang. Algebra (Revised Third Edition). Springer- Verlag, 2002. 



33 



[Lay92] Steven R. Lay. Convex Sets and their Applications. Krieger Publishing Company, 1992. 

[LP90] Richard J. Lipton and Arvin Park. The processor identity problem. Information Processing 
Letters, 36(2):91-94, October 1990. 

[Par66] Rohit J. Parikh. On context-free languages. J. ACM, 13(4):570-581, 1966. 

[PPTV98] Alessandro Panconesi, Marina Papatriantafilou, Philippas Tsigas, and Paul Vitanyi. Random- 
ized naming using wait-free shared variables. Distributed Computing, 11(3): 113-124, August 
1998. 

[Pre29] Mojzesz Presburger. Uber die Vollstandigkeit eines gewissen Systems der Arithmetik ganzer 
Zahlen, in welchem die Addition als einzige Operation hervortritt. In Comptes-Rendus du I 
Congres de Mathematiciens des Pays Slaves, pages 92-101, Warszawa, 1929. 

[Sak99] Naoshi Sakamoto. Comparison of initial conditions for distributed algorithms on anonymous 
networks. In Proc. 18th ACM Symposium on Principles of Distributed Computing, pages 
173-179, 1999. 

[Ten90] Shang-Hua Teng. Space efficient processor identity protocol. Information Processing Letters, 
34(3): 147-154, April 1990. 



34 



